How coaching courses leak through staff, faculty and admin logins

The cleanest copy of your course was never in a student's account. It's on a faculty laptop, in an editor's Drive folder or behind the admin login five people share, and none of it carries a student watermark. Most of the fix is discipline: narrow roles, one institute-owned home for raw files, and accounts shut the day someone leaves. The rest is making staff watch through named, watermarked logins, exactly as students do.

Who inside an institute holds a copy

Follow one lecture from camera to app. Say a UPSC institute in Old Rajinder Nagar records a polity lecture in its studio. The camera card goes to an editor, often a freelancer working from home in another city, by Drive link or pen drive. The faculty member gets an exported MP4 on WhatsApp to approve. Someone on the content team uploads the final file and attaches the PDF notes. Before a student presses play, five or six people have held a copy with no student watermark on it.

Others never touch the files but can still reach the courses. Batch managers add students and reset device limits. Counsellors hand out demo access to parents. The owner's login sees everything, and its password often ends up in a staff WhatsApp group the first time someone needs to fix a batch at night.

What a leak from inside looks like

A leaked copy shows where in the chain it was taken. Student copies usually carry a watermark, player controls, or the tilt and glare of a phone filming a screen. Inside copies look different. One is the raw cut, retakes and all, with the teacher telling the editor "ye part cut kar dena". Another still has your own file names, like Polity_L14_final_v2.mp4, or a whole batch turns up at once in your internal folder order.

Lectures that surface before their release date point the same way. So do editable PPT or Word files when students only ever got PDFs, and answer keys that are out before the test window closes. If a rival's counsellors start calling your current students by name, look at who could export your student list.

These signs point to a stage in the chain, never to a person. Several people touch every stage, and plenty of inside leaks involve no bad intent. An old laptop gets sold with files still on it, or someone shares a personal Drive folder as "anyone with the link" to save time. Check the logs and the custody of the files first, and take legal advice before you put anything to a member of staff.

One login per person, with only the rights the job needs

A login called admin or content, used by four people, makes every log useless. When something leaks, the record says admin downloaded it. Shared passwords also never get changed when someone leaves, because that would lock everyone else out. Give every person their own login, down to the part-time data-entry operator, and turn on two-step verification wherever your platform and email accounts offer it.

Then trim each role to what the job needs. Downloading original files, exporting the question bank and exporting student lists should sit with the owner and one named deputy. Faculty can upload and watch their own courses without seeing anyone else's. Batch managers can add students and reset devices without being able to export the batch.

Student lists deserve the tightest grip. A counsellor who forwards a lead sheet of your current batch has moved personal data out of your control. Section 8(5) of the DPDP Act, 2023 requires reasonable security safeguards against that kind of breach, a duty that applies from May 2027. Our DPDP checklist for coaching institutes covers the access control and logs the Rules expect.

Free accounts need their own rule. Toppers, relatives, staff children, a principal you want to impress: each complimentary account belongs to one named person. It ends on a fixed date and carries that person's watermark, like a paying student's. Go through the list every month and close anything nobody can explain.

Tighter roles have a cost. The batch manager who can't reset devices will call you at 10 pm when a student changes phones the night before a mock test. Leave that right with the batch manager and log it, rather than handing full admin to everyone who asks.

Keep raw recordings in one place the institute owns

Raw recordings are the riskiest files you have, because nothing on them identifies who copied them. A copy taken through your player carries a viewer's mark. A copy of the camera file carries nothing. So keep raw files with as few people as possible, for as short a time as possible.

Pick one storage account that the institute owns and make it the only home for masters. In Google Workspace that's a shared drive: files in a shared drive belong to the team rather than an individual, and they stay put when a member's account is deleted. Editors download what they need for the current batch, return the edited file to the same folder and lose access once the batch is published. Nothing goes into personal Drive accounts or WhatsApp chats. Studio pen drives and hard disks get a number and a line in a register, however old-fashioned that feels.

Approvals are the easiest gap to close. Don't send the teacher an exported MP4 on WhatsApp. Publish the lecture to a staff-only batch and let them review it under their own login, so the approval copy carries a mark too.

Some copies you can't control. A teacher who records at home on her own laptop will always have one, and you can't check that she deleted it. We wouldn't buy monitoring software for staff laptops to fight that. It doesn't reach a visiting teacher's home computer, good staff resent it, and it treats the people you rely on as suspects. Spend the effort on fewer copies and a clear written agreement instead.

The day someone leaves

Access gets removed weeks late, if at all, because nobody owns the job. Give it to one person and run the same list for every exit, from a star faculty member to a part-time typist. For a planned exit, time the lock-out to the last working hour. Anyone who wants to take material has the weeks before they resign to do it. That's why the look back through the logs matters as much as the lock-out.

1. Disable their platform login and remove any admin or staff role.
   
   
2. Remove them from the institute's shared drive, and move any institute files out of their personal Drive.
   
   
3. Change every password they knew. That covers the YouTube channel and social pages, the payment gateway, the domain registrar and app store accounts, and the bulk SMS or WhatsApp Business account.
   
   
4. Take them out of staff WhatsApp and Telegram groups where files and links get shared.
   
   
5. Close any free student accounts they created.
   
   
6. Collect institute laptops, hard disks and pen drives, and record in writing which raw files were handed over.
   
   
7. Review their activity for the last four to six weeks: bulk downloads, exports, and viewing of courses outside their own subject.
   
   
8. Send a short, friendly exit letter restating the confidentiality and ownership terms they signed. It's a record, and a reminder to someone who may already be planning a channel of their own.
   
   

Why an ownership clause beats a non-compete

The legal points in this article are general information, not legal advice, and a lawyer should draft the documents. Every staff and faculty agreement should make unreleased lectures, test papers and student data confidential. It should require masters and source files to be returned or deleted at the end, and bar uploading institute recordings to personal channels. For visiting and freelance faculty, add a written assignment of copyright in the recordings and notes. Section 19 of the Copyright Act, 1957 makes an assignment valid only if it is in writing and signed. Our guide on copyright ownership and registration for coaching material explains who owns what by default.

Don't build your protection on a non-compete. Section 27 of the Indian Contract Act, 1872 makes an agreement that restrains anyone from a lawful profession void to that extent. Courts have generally refused to enforce such restraints once employment has ended. A clause saying a teacher can't teach for a rival for two years is weak protection. A clause saying the recordings and notes belong to the institute is far stronger.

Put staff on watermarked logins too

Tracing works only for copies that pass through the player, so staff should use the player like everyone else. Every staff member watches through their own named login, never a generic test or admin account. Preview and review screens should carry the viewer's mark just as a student's screen does. A copy filmed or recorded from a staff screen then points to that staff account. Our piece on dynamic watermarking for video explains why the mark has to keep moving.

Tell staff in writing, at induction, that their accounts are watermarked and their activity is logged. It's fair to them, and people who know a copy can be traced think twice. If a leaked copy does carry a staff account's mark, treat it as you would a student's. Keep the evidence, check the account's history and hear the person out. Getting around the platform's protection to take copies can also be an offence under section 65A of the Copyright Act. For takedowns, the steps in our guide to removing leaked course content apply unchanged.

Roles, file custody and exit lists are work only you can do, and they cost nothing but follow-through. What they can't do is tell you which login a leaked copy came from. VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. To see the watermarks on a real course, book a demo with our team.

Frequently asked questions

Can I stop a faculty member keeping copies of lectures they recorded?

Not physically, if they recorded on their own equipment. You can collect the masters at handover and get a signed agreement on who owns the recordings and what the teacher may do with them. After that, the agreement and your ability to trace copies are what protect you.

Should faculty be able to download their own lectures?

Rarely. A teacher who wants to check a lecture can watch it through their own watermarked login. If they need a file, say for a demo class at a school, export it yourself and note it in the register.

What should I do if I think a staff member leaked a course?

Preserve the evidence first and keep it quiet. Save the leaked copies and links, export the activity logs for the accounts involved, and start takedowns as you would for any leak. Take legal advice before you confront anyone, because a wrong accusation in a small team does lasting damage.